This vulnerability is an Improper Link Resolution error in the Windows Update Orchestrator Service that allows an attacker with sufficient local privileges to read sensitive information from the file system. The flaw manifests when the service resolves an untrusted path reference before accessing a file, leading to disclosure of potentially confidential data. The associated weakness is a CWE-59 scenario: improper handling of symbolic links or shortcut files.

Microsoft Windows 10 version 21H2, Windows 10 version 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, Windows 11 version 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core installations). The affected builds include both x86, x64, and arm64 architectures as specified by the supplied CPE list.

The CVSS score of 5.5 indicates a medium severity impact, while the EPSS score is not available, suggesting that no data is currently reported for exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed widespread use is known at this time. Based on the description, the attack vector is local, requiring an attacker to have authorized access to the target system; once the attacker can trigger the Update Orchestrator Service, the improper link resolution can be exploited to read files that should be access‑controlled.